[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"detail-sidebar-cat-1-en-105":3,"doc-seo-246765-105":53,"doc-detail-246765-en":126},{"code":4,"msg":5,"data":6},0,"success",[7,14,19,24,29,34,39,44,49],{"id":8,"doc_module":9,"doc_module_name":10,"category_name":11,"show_sort_weight":12,"slug":13},11,1,"Template","Presentations",90,"presentations",{"id":15,"doc_module":9,"doc_module_name":10,"category_name":16,"show_sort_weight":17,"slug":18},12,"Resumes",80,"resumes",{"id":20,"doc_module":9,"doc_module_name":10,"category_name":21,"show_sort_weight":22,"slug":23},14,"Invoices",70,"invoices",{"id":25,"doc_module":9,"doc_module_name":10,"category_name":26,"show_sort_weight":27,"slug":28},15,"Posters",60,"posters",{"id":30,"doc_module":9,"doc_module_name":10,"category_name":31,"show_sort_weight":32,"slug":33},16,"Social Media",50,"social-media",{"id":35,"doc_module":9,"doc_module_name":10,"category_name":36,"show_sort_weight":37,"slug":38},17,"Forms",40,"forms",{"id":40,"doc_module":9,"doc_module_name":10,"category_name":41,"show_sort_weight":42,"slug":43},18,"Letters",30,"letters",{"id":45,"doc_module":9,"doc_module_name":10,"category_name":46,"show_sort_weight":47,"slug":48},21,"Paper Templates",5,"papers-templates",{"id":50,"doc_module":9,"doc_module_name":10,"category_name":51,"show_sort_weight":4,"slug":52},158,"General","general-158",{"code":4,"msg":54,"data":55},"ok",{"site_id":56,"language":57,"slug":58,"title":59,"keywords":60,"description":61,"schema_data":62,"social_meta":119,"head_meta":121,"extra_data":123,"updated_unix":125},105,"en","san-francisco-state-university-information-technology-services-its-incident-response-report-form-280","San Francisco State University - Information Technology Services (ITS) - Incident Response Report Form - 2.8.0","","Incident Response Report form version 2.8.0 for San Francisco State University Information Technology Services (ITS), used to document and triage information security events that could threaten confidentiality, integrity, or availability of university IT assets. The form distinguishes reportable incidents from isolated low-impact events, guides users to submit a Service Desk ticket with specific urgency and description conventions, and collects detailed evidence and containment-related observations. It includes mandatory in-depth synopsis questions covering principals, detection and occurrence timing, malware involvement, transmission vectors, unauthorized access indicators, and related artifacts.",{"@graph":63,"@context":118},[64,80,101],{"@type":65,"itemListElement":66},"BreadcrumbList",[67,71,74,77],{"item":68,"name":69,"@type":70,"position":9},"https://docshare.wps.com","Home","ListItem",{"item":72,"name":10,"@type":70,"position":73},"https://docshare.wps.com/template/",2,{"item":75,"name":36,"@type":70,"position":76},"https://docshare.wps.com/template/forms/",3,{"item":78,"name":59,"@type":70,"position":79},"https://docshare.wps.com/template/san-francisco-state-university-information-technology-services-its-incident-response-report-form-280/246765/",4,{"url":78,"name":59,"@type":81,"image":82,"author":87,"headline":59,"publisher":90,"fileFormat":93,"inLanguage":57,"description":61,"dateModified":94,"datePublished":95,"encodingFormat":93,"isAccessibleForFree":96,"interactionStatistic":97},"DigitalDocument",{"url":83,"@type":84,"width":85,"height":86},"https://docshare.wps.com/thumbnails/san-francisco-state-university-information-technology-services-its-incident-response-report-form-280/246765.png","ImageObject",442,249,{"name":88,"@type":89},"Rizky","Person",{"url":68,"name":91,"@type":92},"DocShare","Organization","application/pdf","2026-10-22","2026-09-12",true,{"@type":98,"interactionType":99,"userInteractionCount":8},"InteractionCounter",{"@type":100},"ViewAction",{"@type":102,"mainEntity":103},"FAQPage",[104,110,114],{"name":105,"@type":106,"acceptedAnswer":107},"When must an information security incident be reported using this form?","Question",{"text":108,"@type":109},"Report incidents that violate SF State information security policy and could seriously compromise confidentiality, integrity, or availability of university IT assets. Isolated low-impact events that do not put Level 1 or Level 2 protected data at risk can generally be handled without this form.","Answer",{"name":111,"@type":106,"acceptedAnswer":112},"How should the Service Desk ticket be submitted during initial assessment?",{"text":113,"@type":109},"Open a Service Desk ticket and set “Urgency” to “Security/Health/Safety,” “Assignment Group” to “ITS Security L2,” and start “Short Description” with “INFOSEC Incident” followed by the caller’s name and a brief incident synopsis. Place principals responses and the series of questions in the ticket’s initial description.",{"name":115,"@type":106,"acceptedAnswer":116},"Which details are required in the in-depth synopsis section?",{"text":117,"@type":109},"The in-depth synopsis questions are mandatory and cover network connection, detection timing (including uncertainty ranges), whether detection and occurrence coincide, malware involvement, likely malware transmission mechanism, and indications of unauthorized access. The form also prompts additional context and emphasizes attachment of relevant evidence and artifacts.","https://schema.org",{"og:url":78,"og:type":120,"og:title":59,"og:site_name":91,"og:description":61},"article",{"robots":122,"canonical":78},"index,follow",{"doc_id":124,"site_id":56},246765,1789238023,{"code":4,"msg":5,"data":127},{"doc_id":124,"user_id":128,"nickname":88,"user_avatar":129,"doc_module":9,"category_id":35,"category_name":36,"doc_title":59,"doc_description":61,"doc_content":130,"file_id":131,"file_url":132,"file_type":133,"file_size":134,"view_count":8,"is_deleted":4,"is_public":9,"is_downloadable":9,"audit_status":9,"page_count":135,"language":136,"language_code":57,"site_id":56,"html_lang":57,"table_of_contents":137,"faqs":138,"seo_title":139,"seo_description":61,"update_tm":125,"read_time":79},962085564807,"https://ap-avatar.wpscdn.com/davatar_6f874abed73319feea01a86fa6f0fab8","San Francisco State University  \nInformation Technology Services (ITS)  \n\n| Incident Response Report\u003Cbr>Form version 2.8.0 | Date Report Submitted (PST)  20yy / mm / dd |\n| --- | --- |\n|  | Date of Incident (PST)  20yy / mm / dd |\n|  | \u003Cbr>Service Now Ticket \\#\u003Cbr>________________________ |\n\nPrincipals  \nUser/System Admin Identification Device Identification  \n\n| User’s Name Email Address Phone Number SFSU Employee ID Office Location Department Job Title\u003Cbr>User’s Availability Supervisor’s Name Supervisor’s Email Supervisor’s Phone |  | Vendor Make Model\u003Cbr>OS/Firmware SFSU Property Tag Computer Name IP Address\u003Cbr>MAC Address\u003Cbr>Device Encryption |  |\n| --- | --- | --- | --- |\n|  |  |  |  |\n|  |  |  |  |\n|  |  |  |  |\n|  |  |  |  |\n|  |  |  |  |\n|  |  |  |  |\n|  |  |  |  |\n|  |  |  | [ ] Yes [ ] No |\n|  |  | Encryption Key | Convey to ITS in person |\n|  |  |  | Upon request |\n\nUsage  \nAn Information Security Incident is an event that violates SF State information security policy in such away that it has the potential to seriously compromise the confidentiality, integrity or availability of SF State information technology assets.  \nNot all incidents need to be reported. Isolated low impact events that do not put protected (Level 1 or Level 2) data at risk generally can be handled without using this form. Such incidents can be addressed internally. Though for the sake of maintaining university-wide statistics it’s worthwhile to submit an incident ticket to the Service Desk along with the relevant details and mark the entry as “resolved.”  \nInitial Assessment (Triage)  \nThis section is used to assist in evaluating the potential severity of an incident and should be completed as soon as possible after it occurs.  \nPlease convey this preliminary information by opening a Service Desk ticket (e.g. [https://sfsu.service](https://sfsu.service)[now.edu/](now.edu/)) . When submitting a ticket for a suspected incident the “Urgency” field should be set to“Security/Health/Safety.” The “Assignment Group” field should be set to “ITS Security L2 .” The “Short Description” field should begin with the phrase “INFOSEC Incident” followed by the name of the caller and a brief synopsis of the incident. For example:  \nINFOSEC Incident -Jonas Salk Malicious Email Attachment  \nA more detailed synopsis should be placed in the “Description” field.  \nPlace responses to both the “Principals” section and the following series of questions in the ticket’s initial description. Someone from ITS will either respond via the help desk system, or contact you directly by phone. Please resist the urge to provide curt, obstructive, response like “Don’t know.”  \nOnce you’ve processed the initial assessment questions and contacted ITS please complete the “InDepth Synopsis” section of this form and attach the completed Incident Response form to the Service Desk ticket.  \nFinally, this is a Microsoft Word document and it’s intended to be edited.  \n􀂃 Please delete sections that you don’t complete  \n􀂃 Also use text highlighting to help signify your entries.  \nWho observed the incident? Is this user the same person who initiated the event?  \nAt this point you may need to interview the user to elicit additional details.  \nWhat was the user doing at the time of the incident?  \nWhat indicators of compromise have been observed?  \nDepending on the nature of the incident, are there indicators or artifacts which provide additional context about the incident? Emphasize quality and relevance of data over sheer quantity while maintaining completeness.  \nFor example: screen shots, log files on the breached endpoint, browser history, URLs, timestamps, email messages, DNS cache entries, executable file paths, server-side audit trails, etc.  \nAttach related artifacts (with the exception of executable files and potentially malicious documents) to the ticket for this incident. Screen shots in particular should attempt to capture as much useful information as possible.  \nCan the indicators o","cbCaioW4NVu0UlpL","https://ap.wps.com/l/cbCaioW4NVu0UlpL","pdf",300111,10,"English","# Incident Response Report Form version 2.8.0\n## Principals\n## Usage\n## Initial Assessment (Triage)\n## In-Depth Synopsis","[{\"question\":\"When must an information security incident be reported using this form?\",\"answer\":\"Report incidents that violate SF State information security policy and could seriously compromise confidentiality, integrity, or availability of university IT assets. Isolated low-impact events that do not put Level 1 or Level 2 protected data at risk can generally be handled without this form.\"},{\"question\":\"How should the Service Desk ticket be submitted during initial assessment?\",\"answer\":\"Open a Service Desk ticket and set “Urgency” to “Security/Health/Safety,” “Assignment Group” to “ITS Security L2,” and start “Short Description” with “INFOSEC Incident” followed by the caller’s name and a brief incident synopsis. Place principals responses and the series of questions in the ticket’s initial description.\"},{\"question\":\"Which details are required in the in-depth synopsis section?\",\"answer\":\"The in-depth synopsis questions are mandatory and cover network connection, detection timing (including uncertainty ranges), whether detection and occurrence coincide, malware involvement, likely malware transmission mechanism, and indications of unauthorized access. The form also prompts additional context and emphasizes attachment of relevant evidence and artifacts.\"}]","San Francisco State University - Information Technology Services (ITS) - Incident Response Report Form - 2.8.0 | PDF"]